fix: security, data-integrity, and doc-drift findings from repo audit

Consolidates duplicate KIS API client implementations (governance tests
were exercising an unused class instead of the one actually running in
production), closes a SQL injection path in the DB admin page, fixes a
migration that used MySQL-only syntax and had never actually applied
(confirmed against production), resyncs docs/db/quantengine.dbml with
all migrations, and removes a duplicate OMS·WMS·ERP frontend tree in
favor of src/frontend/. Also corrects several unverifiable/inflated
claims in the OMS planning docs and realigns CI/CD and architecture
documentation with what's actually in the repo.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

src/dotnet/QuantEngine.Infrastructure/Services/KisApiClient.cs

@@ -22,11 +22,11 @@ public class KisApiClient : IKisApiClient
     private const int TokenRefreshSkewMinutes = 10;
 
     private static readonly string[] ForbiddenPathSubstrings = { "/trading/" };
-    private static readonly string[] ForbiddenTrIdPrefixes =
-    {
-        "TTTC08", "VTTC08", "TTTC01", "VTTC01",
-        "TTTC8434R", "VTTC8434R"
-    };
+
+    // 실제 매수/매도 주문 TR_ID는 전부 TTTC/VTTC로 시작한다 (governance/rules/06_no_direct_api_trading.yaml).
+    // 개별 주문 코드를 나열하면 목록에 없는 신규 주문 TR_ID가 새어나갈 수 있으므로 접두사 전체를 차단한다.
+    // 이 클라이언트가 실제로 호출하는 조회용 TR_ID는 전부 FH로 시작해 이 규칙과 절대 겹치지 않는다.
+    private static readonly string[] ForbiddenTrIdPrefixes = { "TTTC", "VTTC" };
 
     private readonly HttpClient _httpClient;
     private readonly ITokenCache _tokenCache;